Unauthenticated Remote Code Execution in UI-TARS-desktop mcp-http-server

CVE-2026-81735 affects the mcp-http-server package used within UI-TARS-desktop. The vulnerability arises from two misconfigurations: the default listen address for the SSE and Streamable HTTP transports is set to '::' (all interfaces), and the authentication middleware is optional and not implemented by the @agent-infra/mcp-server-commands or @agent-infra/mcp-server-filesystem entry points.

When these servers are deployed without explicit middleware, they accept unauthenticated requests. The commands server exposes a 'run_command' tool that utilizes child_process.exec to execute caller-supplied strings, leading to full Remote Code Execution (RCE) with the privileges of the server process. Additionally, the filesystem server allows unauthenticated read and write access to files. The vulnerability was mitigated in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, which changed the default bind address from '::' to '127.0.0.1'. Organizations using versions of the package prior to this commit are at high risk if the server is exposed to any network interface other than localhost.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the host OS and read or modify any files accessible to the application service user. This poses a critical risk to infrastructure integrity and data confidentiality, as there is no requirement for authentication to interact with the exposed MCP transport methods.

Recommendation

• Update UI-TARS-desktop to a version containing or incorporating commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 to enforce local-only binding.
• Restrict network access to the server ports to '127.0.0.1' via host-level firewalls or network access control lists (ACLs) as an immediate mitigation.
• Audit logs for HTTP requests directed to the SSE or Streamable HTTP MCP transport endpoints, specifically monitoring for 'run_command' tool invocations in the request body.